@oh-my-pi/pi-ai 17.2.7 → 17.2.9

package/CHANGELOG.md

@@ -2,6 +2,17 @@
 
 ## [Unreleased]
 
+## [17.2.9] - 2026-08-05
+
+### Fixed
+
+- Fixed GitHub Copilot requests failing with a raw `HTTP 400 model_not_available_for_integrator` on roughly half of all turns for recently rolled-out models. Copilot's fleet is not uniform — part of it rejects models that `/models` advertises on the same host — and the transient classifier matched only the older `model_not_supported` code at a fixed envelope depth, so these rejections surfaced as terminal errors instead of entering the existing retry path. Model-availability 400s are now recognized at any envelope depth and rerolled on a flat delay with a dedicated 8-attempt budget on the OpenAI transports; every other retryable failure keeps its previous backoff and attempt count.
+- Fixed Cursor reads with inline OMP range selectors reporting the returned slice length as the source file's `totalLines`, which made sequential reads of an unchanged file appear inconsistent ([#7590](https://github.com/can1357/oh-my-pi/issues/7590)).
+- Made model-scoped usage health ignore Codex accounts that cannot use the requested plan-gated model while retaining conservative unknown-state handling and independent usage-window resets.
+- Fixed OpenAI Codex usage telemetry blocking explicitly allowed ChatGPT Team credentials when a weekly `used_percent` rounded to 100, which could route multi-account sessions to an actually exhausted sibling instead ([#7617](https://github.com/can1357/oh-my-pi/issues/7617)).
+- Fixed OpenAI Codex GPT-5.x requests sending optional `reasoning.summary`, `reasoning.context`, and `text.verbosity` controls by default, reducing Codex `server_error` disconnects from unsupported request shapes. ([#4949](https://github.com/can1357/oh-my-pi/issues/4949))
+- Classified concurrent-request caps separately from quota exhaustion so they use a short retry backoff without burning a credential, and rotate credentials for account-scoped 403 caps such as Devin's overall message limit.
+
 ## [17.2.7] - 2026-08-03
 
 ### Changed

package/dist/types/auth/sqlite-credential-store.d.ts

@@ -0,0 +1,117 @@
+/**
+ * SQLite-backed credential persistence for AuthStorage.
+ *
+ * The public AuthCredentialStore interface remains in ../auth-storage so local
+ * and remote stores share the same contract.
+ */
+import { Database } from "bun:sqlite";
+import type { AuthCredential, AuthCredentialStore, CredentialRefreshLeaseFence, DisabledCredentialSummary, StoredAuthCredential, StoredCredentialBlock } from "../auth-storage.js";
+import type { OAuthCredentials } from "../registry/oauth/types.js";
+import type { ClientUsageReport, ClientUsageSummary, UsageCostHistoryEntry, UsageCostHistoryQuery, UsageHistoryEntry, UsageHistoryQuery } from "../usage.js";
+export declare const USAGE_REPORT_TTL_MS: number;
+type SerializedCredentialRecord = {
+    credentialType: AuthCredential["type"];
+    data: string;
+    identityKey: string | null;
+};
+/**
+ * SQLite's busy result code family — base `SQLITE_BUSY` plus the extended
+ * variants `SQLITE_BUSY_RECOVERY` (concurrent WAL recovery), `SQLITE_BUSY_SNAPSHOT`,
+ * and `SQLITE_BUSY_TIMEOUT`. All warrant the same backoff-and-retry treatment.
+ */
+export declare function isSqliteBusyError(err: unknown): boolean;
+/**
+ * SQLite's unrecoverable-corruption result codes — the `SQLITE_CORRUPT` family
+ * (base plus extended variants like `SQLITE_CORRUPT_VTAB` / `SQLITE_CORRUPT_INDEX`)
+ * and `SQLITE_NOTADB` (the file header is not a database). Unlike
+ * {@link isSqliteBusyError}, these never clear by retrying: the store must be
+ * repaired or replaced, so callers latch and stop touching it.
+ */
+export declare function isSqliteCorruptionError(err: unknown): boolean;
+export declare function serializeCredential(provider: string, credential: AuthCredential): SerializedCredentialRecord | null;
+export declare function resolveCredentialIdentityKey(provider: string, credential: AuthCredential): string | null;
+/**
+ * Default SQLite-backed implementation of {@link AuthCredentialStore}.
+ *
+ * Used by the pi-ai CLI and as the default store for `AuthStorage.create()`.
+ * Also exposes convenience methods (`saveOAuth`, `getOAuth`, `saveApiKey`,
+ * `getApiKey`, `listProviders`, `deleteProvider`) that callers can use directly
+ * without going through `AuthStorage`.
+ */
+export declare class SqliteAuthCredentialStore implements AuthCredentialStore {
+    #private;
+    constructor(db: Database);
+    static open(dbPath?: string): Promise<SqliteAuthCredentialStore>;
+    listAuthCredentials(provider?: string): StoredAuthCredential[];
+    listDisabledCredentials(provider?: string): Promise<DisabledCredentialSummary[]>;
+    replaceAuthCredentialsForProvider(provider: string, credentials: AuthCredential[]): StoredAuthCredential[];
+    upsertAuthCredentialForProvider(provider: string, credential: AuthCredential): StoredAuthCredential[];
+    updateAuthCredential(id: number, credential: AuthCredential): void;
+    tryUpdateAuthCredentialIfMatches(id: number, expectedData: string, credential: AuthCredential, lease?: CredentialRefreshLeaseFence): boolean;
+    deleteAuthCredential(id: number, disabledCause: string): void;
+    /**
+     * CAS-style disable: only soft-deletes the row when its `data` column still
+     * matches `expectedData` and the row has not already been disabled. Used by
+     * the OAuth refresh-failure path to avoid clobbering a peer that rotated the
+     * row between our pre-check and the disable.
+     */
+    tryDisableAuthCredentialIfMatches(id: number, expectedData: string, disabledCause: string, lease?: CredentialRefreshLeaseFence): boolean;
+    deleteAuthCredentialsForProvider(provider: string, disabledCause: string): void;
+    getCache(key: string, options?: {
+        includeExpired?: boolean;
+    }): string | null;
+    setCache(key: string, value: string, expiresAtSec: number): void;
+    /** Drop all cache rows whose keys start with the supplied prefix. */
+    deleteCachePrefix(prefix: string): void;
+    cleanExpiredCache(): void;
+    getCredentialBlock(credentialId: number, providerKey: string, blockScope: string): number | undefined;
+    getCredentialBlockReconcileAfter(credentialId: number, providerKey: string, blockScope: string): number | undefined;
+    upsertCredentialBlock(block: StoredCredentialBlock): void;
+    deleteCredentialBlock(credentialId: number, providerKey: string, blockScope: string): void;
+    deleteCredentialBlocks(credentialId: number): void;
+    cleanExpiredCredentialBlocks(nowMs: number): void;
+    listCredentialBlocks(credentialIds: readonly number[]): StoredCredentialBlock[];
+    tryAcquireCredentialRefreshLease(credentialId: number, owner: string, expiresAtMs: number): boolean;
+    getCredentialRefreshLeaseExpiresAt(credentialId: number): number | undefined;
+    renewCredentialRefreshLease(credentialId: number, owner: string, expiresAtMs: number): boolean;
+    releaseCredentialRefreshLease(credentialId: number, owner: string): void;
+    recordUsageSnapshots(entries: UsageHistoryEntry[]): void;
+    listUsageHistory(query?: UsageHistoryQuery): UsageHistoryEntry[];
+    recordUsageCosts(entries: UsageCostHistoryEntry[]): void;
+    listUsageCosts(query?: UsageCostHistoryQuery): UsageCostHistoryEntry[];
+    recordClientUsage(report: ClientUsageReport): void;
+    getClientUsageSummary(sinceMs: number): ClientUsageSummary;
+    /**
+     * Save OAuth credentials for a provider.
+     * Preserves unrelated identities and replaces only the matching credential.
+     */
+    saveOAuth(provider: string, credentials: OAuthCredentials): void;
+    /**
+     * Get OAuth credentials for a provider.
+     */
+    getOAuth(provider: string): OAuthCredentials | null;
+    /**
+     * Save API key for a provider (replaces existing).
+     */
+    saveApiKey(provider: string, apiKey: string): void;
+    /**
+     * Get API key for a provider.
+     */
+    getApiKey(provider: string): string | null;
+    /**
+     * List all providers with credentials.
+     */
+    listProviders(): string[];
+    /**
+     * Delete all credentials for a provider.
+     */
+    deleteProvider(provider: string): void;
+    /**
+     * SQLite increments `data_version` when another connection commits. Own
+     * writes leave it unchanged and already notify AuthStorage directly.
+     */
+    pollExternalChanges(): boolean;
+    acknowledgeLocalChanges(): void;
+    close(): void;
+}
+export {};

package/dist/types/auth-storage.d.ts

@@ -1,18 +1,9 @@
-/**
- * Credential storage for API keys and OAuth tokens.
- * Handles loading, saving, refreshing credentials, and usage tracking.
- *
- * This module defines:
- * - `AuthCredentialStore` interface: persistence abstraction (SQLite, remote vault, …)
- * - `AuthStorage` class: credential management with round-robin, usage limits, OAuth refresh
- * - `SqliteAuthCredentialStore`: concrete SQLite-backed implementation
- */
-import { Database } from "bun:sqlite";
 import type { ApiKeyResolver } from "./auth-retry.js";
 import type { OAuthAuthInfo, OAuthController, OAuthCredentials, OAuthProviderId } from "./registry/oauth/types.js";
 import type { Provider } from "./types.js";
 import type { ClientUsageReport, ClientUsageSummary, CredentialRankingStrategy, ObservedUsageEntry, UsageCostHistoryEntry, UsageCostHistoryQuery, UsageHistoryEntry, UsageHistoryQuery, UsageLogger, UsageProvider, UsageReport } from "./usage.js";
 import { type CodexResetConsumeCode, type CodexResetCredit } from "./usage/openai-codex-reset.js";
+export { isSqliteBusyError, isSqliteCorruptionError, SqliteAuthCredentialStore, } from "./auth/sqlite-credential-store.js";
 export type ApiKeyCredential = {
     type: "api_key";
     key: string;
@@ -1265,101 +1256,3 @@ export declare class AuthStorage {
      */
     describeCredentialSource(provider: string, sessionId?: string): string | undefined;
 }
-/**
- * SQLite's busy result code family — base `SQLITE_BUSY` plus the extended
- * variants `SQLITE_BUSY_RECOVERY` (concurrent WAL recovery), `SQLITE_BUSY_SNAPSHOT`,
- * and `SQLITE_BUSY_TIMEOUT`. All warrant the same backoff-and-retry treatment.
- */
-export declare function isSqliteBusyError(err: unknown): boolean;
-/**
- * SQLite's unrecoverable-corruption result codes — the `SQLITE_CORRUPT` family
- * (base plus extended variants like `SQLITE_CORRUPT_VTAB` / `SQLITE_CORRUPT_INDEX`)
- * and `SQLITE_NOTADB` (the file header is not a database). Unlike
- * {@link isSqliteBusyError}, these never clear by retrying: the store must be
- * repaired or replaced, so callers latch and stop touching it.
- */
-export declare function isSqliteCorruptionError(err: unknown): boolean;
-/**
- * Default SQLite-backed implementation of {@link AuthCredentialStore}.
- *
- * Used by the pi-ai CLI and as the default store for `AuthStorage.create()`.
- * Also exposes convenience methods (`saveOAuth`, `getOAuth`, `saveApiKey`,
- * `getApiKey`, `listProviders`, `deleteProvider`) that callers can use directly
- * without going through `AuthStorage`.
- */
-export declare class SqliteAuthCredentialStore implements AuthCredentialStore {
-    #private;
-    constructor(db: Database);
-    static open(dbPath?: string): Promise<SqliteAuthCredentialStore>;
-    listAuthCredentials(provider?: string): StoredAuthCredential[];
-    listDisabledCredentials(provider?: string): Promise<DisabledCredentialSummary[]>;
-    replaceAuthCredentialsForProvider(provider: string, credentials: AuthCredential[]): StoredAuthCredential[];
-    upsertAuthCredentialForProvider(provider: string, credential: AuthCredential): StoredAuthCredential[];
-    updateAuthCredential(id: number, credential: AuthCredential): void;
-    tryUpdateAuthCredentialIfMatches(id: number, expectedData: string, credential: AuthCredential, lease?: CredentialRefreshLeaseFence): boolean;
-    deleteAuthCredential(id: number, disabledCause: string): void;
-    /**
-     * CAS-style disable: only soft-deletes the row when its `data` column still
-     * matches `expectedData` and the row has not already been disabled. Used by
-     * the OAuth refresh-failure path to avoid clobbering a peer that rotated the
-     * row between our pre-check and the disable.
-     */
-    tryDisableAuthCredentialIfMatches(id: number, expectedData: string, disabledCause: string, lease?: CredentialRefreshLeaseFence): boolean;
-    deleteAuthCredentialsForProvider(provider: string, disabledCause: string): void;
-    getCache(key: string, options?: {
-        includeExpired?: boolean;
-    }): string | null;
-    setCache(key: string, value: string, expiresAtSec: number): void;
-    /** Drop all cache rows whose keys start with the supplied prefix. */
-    deleteCachePrefix(prefix: string): void;
-    cleanExpiredCache(): void;
-    getCredentialBlock(credentialId: number, providerKey: string, blockScope: string): number | undefined;
-    getCredentialBlockReconcileAfter(credentialId: number, providerKey: string, blockScope: string): number | undefined;
-    upsertCredentialBlock(block: StoredCredentialBlock): void;
-    deleteCredentialBlock(credentialId: number, providerKey: string, blockScope: string): void;
-    deleteCredentialBlocks(credentialId: number): void;
-    cleanExpiredCredentialBlocks(nowMs: number): void;
-    listCredentialBlocks(credentialIds: readonly number[]): StoredCredentialBlock[];
-    tryAcquireCredentialRefreshLease(credentialId: number, owner: string, expiresAtMs: number): boolean;
-    getCredentialRefreshLeaseExpiresAt(credentialId: number): number | undefined;
-    renewCredentialRefreshLease(credentialId: number, owner: string, expiresAtMs: number): boolean;
-    releaseCredentialRefreshLease(credentialId: number, owner: string): void;
-    recordUsageSnapshots(entries: UsageHistoryEntry[]): void;
-    listUsageHistory(query?: UsageHistoryQuery): UsageHistoryEntry[];
-    recordUsageCosts(entries: UsageCostHistoryEntry[]): void;
-    listUsageCosts(query?: UsageCostHistoryQuery): UsageCostHistoryEntry[];
-    recordClientUsage(report: ClientUsageReport): void;
-    getClientUsageSummary(sinceMs: number): ClientUsageSummary;
-    /**
-     * Save OAuth credentials for a provider.
-     * Preserves unrelated identities and replaces only the matching credential.
-     */
-    saveOAuth(provider: string, credentials: OAuthCredentials): void;
-    /**
-     * Get OAuth credentials for a provider.
-     */
-    getOAuth(provider: string): OAuthCredentials | null;
-    /**
-     * Save API key for a provider (replaces existing).
-     */
-    saveApiKey(provider: string, apiKey: string): void;
-    /**
-     * Get API key for a provider.
-     */
-    getApiKey(provider: string): string | null;
-    /**
-     * List all providers with credentials.
-     */
-    listProviders(): string[];
-    /**
-     * Delete all credentials for a provider.
-     */
-    deleteProvider(provider: string): void;
-    /**
-     * SQLite increments `data_version` when another connection commits. Own
-     * writes leave it unchanged and already notify AuthStorage directly.
-     */
-    pollExternalChanges(): boolean;
-    acknowledgeLocalChanges(): void;
-    close(): void;
-}

package/dist/types/error/flags.d.ts

@@ -65,8 +65,10 @@ export declare function isGrammarError(error: unknown): boolean;
  */
 export declare function isFastModeUnsupported(error: unknown): boolean;
 /**
- * GitHub Copilot 400 `model_not_supported` routing flap — transient. Reads the
- * structural `code` (and falls back to {@link Flag.Transient} text classification).
+ * GitHub Copilot 400 rejecting a model its own `/models` catalog advertises —
+ * transient fleet skew, not a malformed request. Reads the structural `code`
+ * through the SDK/body envelopes, then falls back to the stringified body both
+ * SDK families put in `message` (shapes drift; the wire text does not).
  */
 export declare function isCopilotTransientModelError(error: unknown): boolean;
 export declare function classifyMessage(message: {

package/dist/types/error/index.d.ts

@@ -9,5 +9,6 @@ export * from "./format.js";
 export * from "./gateway.js";
 export * from "./oauth.js";
 export * from "./provider.js";
+export * from "./rate-limit.js";
 export * from "./retryable.js";
 export * from "./validation.js";

package/dist/types/error/rate-limit.d.ts

@@ -2,12 +2,12 @@
  * Rate limit reason classification and backoff calculation utilities.
  * Ported from opencode-antigravity-auth plugin for consistency.
  */
-export type RateLimitReason = "QUOTA_EXHAUSTED" | "RATE_LIMIT_EXCEEDED" | "MODEL_CAPACITY_EXHAUSTED" | "SERVER_ERROR" | "UNKNOWN";
+export type RateLimitReason = "QUOTA_EXHAUSTED" | "RATE_LIMIT_EXCEEDED" | "CONCURRENT_LIMIT" | "MODEL_CAPACITY_EXHAUSTED" | "SERVER_ERROR" | "UNKNOWN";
 /**
  * Classify a rate-limit error message into a reason category.
  * Priority order: explicit details in a resource-exhausted error > QUOTA
- * (Antigravity "quota will reset") > MODEL_CAPACITY > QUOTA (account) >
- * RATE_LIMIT > QUOTA (generic) > SERVER_ERROR > bare resource-exhausted > UNKNOWN.
+ * (Antigravity "quota will reset") > CONCURRENT_LIMIT > MODEL_CAPACITY >
+ * QUOTA (account) > RATE_LIMIT > QUOTA (generic) > SERVER_ERROR > bare resource-exhausted > UNKNOWN.
  *
  * Bare "resource exhausted" / "resource_exhausted" maps to MODEL_CAPACITY (transient, short wait).
  * Explicit details such as "quota exceeded" retain their normal classification.
@@ -39,8 +39,10 @@ export declare function isUsageLimitStatus(status: number | undefined): boolean;
  *  3. Body is absent or {@link isOpaqueStatusBody opaque} (just the status,
  *     empty JSON, HTTP framing only) → rotate conservatively: the server
  *     gave us nothing else to go on.
- *  4. Body has content → defer to {@link parseRateLimitReason}. Only
- *     `QUOTA_EXHAUSTED` rotates; `RATE_LIMIT_EXCEEDED` (`Too many requests`,
+ *  4. Body has content → defer to {@link parseRateLimitReason}. `QUOTA_EXHAUSTED`
+ *     rotates; for the categorical 402 billing cap a `CONCURRENT_LIMIT` body
+ *     also rotates (the cap is concurrent-worded but the status is still an
+ *     exhausted billing cap). `RATE_LIMIT_EXCEEDED` (`Too many requests`,
  *     per-minute caps), `MODEL_CAPACITY_EXHAUSTED` (`Service overloaded`),
  *     `SERVER_ERROR`, and `UNKNOWN` (`Please retry in 5s`) stay in the
  *     provider's own backoff layer so transient 429s don't burn sibling
@@ -62,3 +64,17 @@ export declare function isOpaqueStatusBody(message: string): boolean;
  * {@link isUsageLimitOutcome} uses it for the account-rotation decision.
  */
 export declare function matchesUsageLimitText(errorMessage: string): boolean;
+/**
+ * Account-scoped cap phrasing delivered on a 403 (or a statusless Connect
+ * trailer): "Reached overall message rate limit", "Your limit will reset in …".
+ * Kept separate from {@link matchesUsageLimitText} because the bare wording is
+ * ambiguous without the 403 / statusless-account context; consumed by both
+ * {@link isUsageLimitOutcome} (rotation decision) and `flags.ts` (Flag.UsageLimit).
+ */
+export declare function isAccountScopedCapText(message: string): boolean;
+/**
+ * A concurrency cap on a non-billing status is shed-and-backoff, not
+ * credential-rotatable. This mirrors the exclusion in {@link isUsageLimitOutcome}
+ * for the 403 auth-retry entry points. A 402 remains a categorical billing cap.
+ */
+export declare function isConcurrencyCapExclusion(status: number | undefined, message: string | undefined): boolean;

package/dist/types/error/retryable.d.ts

@@ -11,7 +11,7 @@ export declare function isTransientStatus(status: number | undefined): boolean;
 export interface ProviderRetryableHooks {
     /** Provider id of the failing request, used to gate provider-specific checks. */
     provider?: string;
-    /** Provider-specific transient predicate (e.g. Copilot `model_not_supported`). */
+    /** Provider-specific transient predicate (e.g. Copilot model-availability 400s). */
     isProviderTransient?: (error: Error) => boolean;
 }
 /**

package/dist/types/providers/anthropic.d.ts

@@ -188,8 +188,8 @@ export declare function resolveAnthropicCustomHeadersForBaseUrl(baseUrl: string
 /**
  * Whether an Anthropic (or Copilot-over-Anthropic) stream error should be
  * retried. The classification lives in {@link AIError.isProviderRetryableError};
- * this wrapper injects the Copilot-specific `model_not_supported` transient
- * check, which the error module must not import directly.
+ * this wrapper injects the Copilot-specific model-availability transient check,
+ * which the error module must not import directly.
  */
 export declare function isProviderRetryableError(error: unknown, provider?: string): boolean;
 export type AnthropicUsageLike = {

package/dist/types/providers/cursor/exec-modern.d.ts

@@ -17,7 +17,7 @@ import type { ToolResultMessage } from "../../types.js";
  * virtual registry. Re-exported here because this is where the frame builders
  * and their translation are consumed together.
  */
-export { piEscapeRegexLiteral, piGrepSkip, piJoinPath, piLimit, piLsPath, piReadDisplayPath, piReadPath, piTimeout, } from "../cursor-pi-args.js";
+export { piEscapeRegexLiteral, piGrepSkip, piJoinPath, piLimit, piLsPath, piReadDisplayPath, piReadPath, piReadPathHasRange, piTimeout, } from "../cursor-pi-args.js";
 /** Flatten a tool result's content into the single `output` string the Pi frames carry. */
 export declare function piOutputText(toolResult: ToolResultMessage): string;
 /**

package/dist/types/providers/cursor-pi-args.d.ts

@@ -36,6 +36,12 @@
  * A range-free read keeps the ordinary form — whole-file reads want them.
  */
 export declare function piReadPath(readPath: string, offset?: number, limit?: number): string | null;
+/**
+ * Whether a read path ends in an OMP line selector, including compound `raw`
+ * forms. Cursor uses this only to describe the operation already executed by
+ * the coding-agent read tool; the selector remains embedded in the path.
+ */
+export declare function piReadPathHasRange(readPath: string): boolean;
 /**
  * The same range as {@link piReadPath}, rendered for a transcript block rather
  * than for execution.

package/dist/types/providers/mock.d.ts

@@ -53,6 +53,7 @@ export type MockContent = string | {
 } | {
     type: "thinking";
     thinking: string;
+    thinkingSignature?: string;
 } | {
     type: "toolCall";
     /** Optional explicit id; auto-generated when omitted. */

package/dist/types/providers/openai-codex/request-transformer.d.ts

@@ -14,7 +14,7 @@ export interface CodexRequestOptions {
     /** User-facing effort; maps 1:1 onto the wire tier of the same name. */
     reasoningEffort?: CodexCallerEffort | "none";
     reasoningSummary?: ReasoningConfig["summary"] | null;
-    /** Explicit `reasoning.context` override; defaults to `all_turns` when unset. Gated to gpt-5.4+ Codex models (older ids reject it, so it is suppressed and `context` omitted). Note that under Responses Lite (`responsesLite`), the server strictly requires `reasoning.context` to be `all_turns`, which overrides this option and forces `all_turns`. */
+    /** Explicit `reasoning.context` override. Omitted by default; Responses Lite forces `all_turns` as required by that transport. */
     reasoningContext?: CodexReasoningContext;
     textVerbosity?: "low" | "medium" | "high";
     include?: string[];

package/dist/types/providers/openai-codex-responses.d.ts

@@ -4,7 +4,7 @@ import type { ResponseInput } from "./openai-responses-wire.js";
 export interface OpenAICodexResponsesOptions extends StreamOptions {
     reasoning?: "none" | "minimal" | "low" | "medium" | "high" | "xhigh" | "max";
     reasoningSummary?: "auto" | "concise" | "detailed" | null;
-    /** `reasoning.context` replay scope; defaults to `all_turns` when unset. The `all_turns` value is gated to gpt-5.4+ Codex models — older ids reject it, so it is suppressed and `context` omitted. */
+    /** Explicit `reasoning.context` replay scope. Omitted by default so Codex applies its native request policy. */
     reasoningContext?: CodexReasoningContext;
     textVerbosity?: "low" | "medium" | "high";
     codexMode?: boolean;

package/dist/types/providers/pi-native-server.d.ts

@@ -4,7 +4,7 @@
  * Where the OpenAI / Anthropic / Responses route modules translate foreign
  * wire shapes through pi-ai's canonical {@link Context}, this module accepts
  * the canonical shape *directly* — for clients that already speak pi-ai
- * (containerized omp, the swarm extension, robomp's sidecar auth-gateway).
+ * (containerized omp, robomp's sidecar auth-gateway).
  * Skipping the wire-format → Context → wire-format round-trip cuts
  * per-request CPU but, more importantly, avoids the quantization that those
  * translations impose on first-class pi-ai fields (service tier, cache

package/dist/types/utils/http-inspector.d.ts

@@ -38,10 +38,11 @@ export declare function finalizeErrorMessage(error: unknown, rawRequestDump: Raw
  * Rewrite error message for GitHub Copilot request failures.
  * Must run AFTER finalizeErrorMessage since it replaces the message entirely.
  *
- * 400 `model_not_supported` = Copilot routing rollout gap for our OAuth client.
- *        A preview model (gpt-5.3-codex, gpt-5.4*, ...) flaps between 200 and
- *        400 because only some of Copilot's backends have the model. After the
- *        in-request retry exhausts, surface guidance rather than the raw error.
+ * 400 model-unavailable = Copilot fleet skew. A model that `/models` advertises
+ *        (claude-sonnet-4.6, claude-opus-4.6, gpt-5.4, gpt-5.3-codex, ...)
+ *        flaps between 200 and 400 because only part of Copilot's fleet has it
+ *        in the integrator allowlist. After the in-request retry exhausts,
+ *        surface guidance rather than the raw error.
  * 401 = token invalid/expired → credential removal is safe, prompt re-login.
  * 403 = token valid but access denied (plan, model policy, org restriction) →
  *       do NOT reuse the auth-failed string (which triggers credential removal).

package/dist/types/utils/retry.d.ts

@@ -1,8 +1,9 @@
 import { isCopilotTransientModelError } from "../error/flags.js";
 export { isCopilotTransientModelError };
 /**
- * Wrap an initial Copilot request so transient `model_not_supported` 400s are
- * retried a small number of times. No-op for non-Copilot providers.
+ * Wrap an initial Copilot request so transient model-availability 400s
+ * (`model_not_supported`, `model_not_available_for_integrator`) are retried a
+ * small number of times. No-op for non-Copilot providers.
  *
  * The callback **MUST** create a fresh in-flight request each invocation — a
  * once-consumed AsyncIterable cannot be re-iterated.

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@oh-my-pi/pi-ai",
-	"version": "17.2.7",
+	"version": "17.2.9",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"homepage": "https://omp.sh",
 	"author": "Can Boluk",
@@ -38,10 +38,10 @@
 	},
 	"dependencies": {
 		"@bufbuild/protobuf": "^2.12.1",
-		"@oh-my-pi/omptype": "17.2.7",
-		"@oh-my-pi/pi-catalog": "17.2.7",
-		"@oh-my-pi/pi-utils": "17.2.7",
-		"@oh-my-pi/pi-wire": "17.2.7",
+		"@oh-my-pi/omptype": "17.2.9",
+		"@oh-my-pi/pi-catalog": "17.2.9",
+		"@oh-my-pi/pi-utils": "17.2.9",
+		"@oh-my-pi/pi-wire": "17.2.9",
 		"zod": "^4"
 	},
 	"devDependencies": {